View Full Microsoft AZ-104 Exam Dumps and Practice Test Dumps.

 

Question 141

You need to assign a custom set of permissions to a user because the built-in Azure RBAC roles do not meet your requirements. What should you create?

1. Azure Policy
2. Custom RBAC role
3. Resource Lock
4. Management Group

Correct Answer: 2

Explanation

A custom Azure RBAC role allows an organization to define specific permissions that match its operational requirements. The role can include selected actions and can be assigned at an appropriate scope such as a subscription, resource group, or resource. This supports the principle of least privilege by granting only the permissions users actually need. Resource Locks protect resources, Management Groups organize subscriptions, and Azure Policy enforces governance rules. Therefore, a custom RBAC role is the correct solution when built-in roles do not provide the required permissions.

Question 142

You need to assign the same Azure RBAC permissions to multiple subscriptions that belong to an organization. Which Azure feature should you use to organize the subscriptions?

1. Availability Set
2. Virtual Network
3. Management Group
4. Resource Group

Correct Answer: 3

Explanation

Azure Management Groups provide a hierarchy for organizing multiple Azure subscriptions. Azure RBAC roles and Azure Policy assignments can be applied at the management group level and inherited by subscriptions and resources underneath it. This makes management groups useful for applying consistent governance and access controls across an organization’s subscriptions. Resource groups organize resources within subscriptions, while availability sets and virtual networks serve different infrastructure purposes. Therefore, a Management Group is the correct choice for organizing and managing multiple subscriptions centrally.

Question 143

You need to prevent a resource group from being deleted while still allowing administrators to modify its resources. Which type of resource lock should you use?

1. ModifyOnly lock
2. NoDeleteReadOnly lock
3. ReadOnly lock
4. CanNotDelete lock

Correct Answer: 4

Explanation

A CanNotDelete resource lock prevents a resource or resource group from being deleted while allowing authorized users to modify its configuration. This is useful for protecting important production resources against accidental deletion without preventing normal administrative changes. A ReadOnly lock prevents modification as well as deletion. The other listed lock types are not valid Azure resource lock types. Therefore, a CanNotDelete lock is the appropriate choice when administrators should be able to modify resources but not delete them.

Question 144

You need to prevent users from changing the configuration of a critical Azure resource and also prevent its deletion. Which resource lock should you use?

1. ReadOnly
2. Contributor
3. CanNotDelete
4. Reader

Correct Answer: 1

Explanation

A ReadOnly resource lock prevents users from modifying or deleting the locked resource. This provides stronger protection than a CanNotDelete lock, which allows modifications but prevents deletion. ReadOnly locks are useful for critical resources that must remain unchanged unless the lock is explicitly removed. Contributor and Reader are Azure RBAC roles rather than resource locks. Therefore, the ReadOnly lock is the correct choice when both modification and deletion must be prevented.

Question 145

You need to assign a user permissions to manage role assignments without giving the user full Owner permissions. Which Azure RBAC role should you use?

1. Reader
2. Storage Blob Data Reader
3. User Access Administrator
4. Virtual Machine Contributor

Correct Answer: 3

Explanation

The User Access Administrator role allows a user to manage access to Azure resources by assigning and removing Azure RBAC roles. It is useful when an administrator needs to manage permissions without having all the resource management capabilities of the Owner role. Reader provides read-only resource access, Virtual Machine Contributor focuses on VM management, and Storage Blob Data Reader provides read access to blob data. Therefore, User Access Administrator is the appropriate role for managing resource access permissions.

Question 146

You need to provide a user with read access to blob data inside an Azure Storage account without allowing them to modify the data. Which role should you assign?

1. Owner
2. Storage Blob Data Reader
3. Storage Account Contributor
4. Storage Blob Data Owner

Correct Answer: 2

Explanation

The Storage Blob Data Reader role provides read access to blob data without granting permissions to modify or delete the data. This role is useful when an application or user needs to retrieve and view blob content but should not make changes. Storage Blob Data Owner provides broader data access, while Storage Account Contributor manages storage account resources rather than specifically providing blob data permissions. Owner provides extensive management and access permissions. Therefore, Storage Blob Data Reader is the best choice for read-only blob data access.

Question 147

You need to assign permissions to an application so it can upload and modify blobs in a storage account. Which role is most appropriate?

1. Storage Blob Data Contributor
2. Reader
3. Network Contributor
4. Storage Blob Data Reader

Correct Answer: 1

Explanation

The Storage Blob Data Contributor role allows a principal to read, write, and delete blob data within supported storage resources. It is appropriate for applications that need to upload new blobs and modify or delete existing blobs. Storage Blob Data Reader provides read-only access, while Reader is primarily used for viewing Azure resource information rather than blob data operations. Network Contributor manages networking resources. Therefore, Storage Blob Data Contributor is the correct role for an application that needs to manage blob content.

Question 148

You need to provide an application with access to Azure Storage without storing a username or password in the application configuration. Which authentication method should you use?

1. Hard-coded password
2. Public IP address
3. Shared local administrator account
4. Managed identity

Correct Answer: 4

Explanation

Managed identity allows an Azure resource or application to authenticate to supported Azure services without storing credentials in source code or configuration files. Azure manages the identity credentials automatically, reducing the risk of exposed passwords or secrets. The managed identity can then be granted the required Azure RBAC permissions on the storage resource. Hard-coded passwords create security risks, while a public IP address is related to networking rather than authentication. Therefore, managed identity is the most secure option among the choices.

Question 149

You need to store an application secret securely and allow an Azure VM to retrieve it using its managed identity. Which service should you use?

1. Azure DNS
2. Azure Key Vault
3. Azure Load Balancer
4. Azure Queue Storage

Correct Answer: 2

Explanation

Azure Key Vault securely stores secrets, keys, and certificates and can integrate with managed identities. An Azure VM can use its managed identity to authenticate to Key Vault and retrieve an authorized secret without requiring credentials to be stored inside the application. Queue Storage is used for messages, Load Balancer distributes traffic, and Azure DNS provides name resolution. Therefore, Azure Key Vault is the correct service for securely storing application secrets and providing controlled access to them.

Question 150

You need to automatically assign a specific tag to newly created Azure resources based on an organizational rule. Which Azure Policy effect can modify resource properties during deployment?

1. Deny
2. Modify
3. Disabled
4. Audit

Correct Answer: 2

Explanation

The Modify effect in Azure Policy can modify resource properties or add required configurations when resources are created or updated, subject to the policy’s capabilities. It can be used to enforce organizational standards such as adding required tags. Audit only records noncompliance, Deny blocks noncompliant resource deployments, and Disabled turns off the policy. Therefore, Modify is the appropriate policy effect when the requirement is to automatically apply a configuration such as a tag.

Question 151

You need to identify resources that do not comply with an organizational policy without preventing their deployment. Which Azure Policy effect should you use?

1. DeployIfNotExists
2. Modify
3. Audit
4. Deny

Correct Answer: 3

Explanation

The Audit effect allows resources to be deployed while recording whether they comply with the assigned policy. This is useful when administrators first want to assess the current environment without blocking deployments. Deny prevents noncompliant resources from being created, while Modify can change supported resource properties. DeployIfNotExists can deploy related resources or configurations when required conditions are missing. Therefore, Audit is the correct effect when the goal is to identify noncompliant resources without blocking deployment.

Question 152

You need Azure Policy to prevent users from creating virtual machines in regions that are not approved by the organization. Which policy effect should you use?

1. Deny
2. Append
3. Audit
4. Disabled

Correct Answer: 1

Explanation

The Deny effect prevents a resource deployment when it violates the assigned Azure Policy. A policy can evaluate the requested Azure region and deny VM creation if the location is outside the organization’s approved list. Audit would only report the violation without blocking deployment. Disabled turns off the policy, while Append is used to add properties to resource requests where supported. Therefore, Deny is the correct policy effect for preventing deployments in unapproved regions.

Question 153

You need to estimate the cost of running several Azure virtual machines with different sizes before deploying them. Which tool should you use?

1. Azure Network Watcher
2. Azure Service Health
3. Azure Monitor
4. Azure Pricing Calculator

Correct Answer: 4

Explanation

The Azure Pricing Calculator helps estimate the expected cost of Azure services before deployment. You can select virtual machine sizes, operating systems, storage, networking, and expected usage to calculate an estimated cost. This makes it useful for comparing deployment configurations and planning budgets. Azure Monitor focuses on monitoring, Service Health provides information about Azure service issues, and Network Watcher provides network diagnostics. Therefore, Azure Pricing Calculator is the correct tool for estimating the cost of planned Azure VM deployments.

Question 154

You need to analyze current and historical Azure spending across multiple subscriptions. Which Azure service should you use?

1. Azure DNS
2. Microsoft Cost Management
3. Azure Bastion
4. Azure Key Vault

Correct Answer: 2

Explanation

Microsoft Cost Management provides tools for analyzing and managing Azure spending. Administrators can review costs, identify spending trends, group costs by different dimensions, and analyze usage across subscriptions and resources. It also supports budgets and cost alerts to help organizations control spending. Azure Bastion provides secure VM access, Key Vault stores secrets and keys, and Azure DNS provides name resolution. Therefore, Microsoft Cost Management is the correct service for analyzing Azure spending and usage.

Question 155

You need to create a budget that sends notifications when Azure spending reaches 80 percent of the planned amount. Which service should you use?

1. Azure Advisor
2. Azure Resource Manager
3. Microsoft Cost Management
4. Azure Monitor

Correct Answer: 3

Explanation

Microsoft Cost Management provides budget functionality that allows administrators to define spending thresholds and configure notifications. A budget can be configured to send alerts when actual or forecasted costs reach a specified percentage, such as 80 percent of the planned amount. Azure Monitor focuses on resource and application monitoring, Advisor provides recommendations, and Resource Manager manages deployments. Therefore, Microsoft Cost Management is the appropriate service for creating a spending budget and notification threshold.

Question 156

You need to view the current status of Azure services and determine whether an ongoing platform issue affects your resources. Which Azure feature should you use?

1. Azure Files
2. Azure Policy
3. Azure Pricing Calculator
4. Azure Service Health

Correct Answer: 4

Explanation

Azure Service Health provides personalized information about Azure service incidents, planned maintenance, health advisories, and other events that may affect resources. It helps administrators determine whether an Azure platform issue could be responsible for a problem experienced by their workloads. Pricing Calculator estimates costs, Azure Policy manages governance, and Azure Files provides managed file shares. Therefore, Azure Service Health is the correct feature for checking Azure service status and resource-impacting incidents.

Question 157

You need to monitor the performance of an Azure virtual machine and collect operating system-level information such as performance counters and logs. Which Azure service should you use?

1. Azure DNS
2. Azure Advisor
3. Azure Monitor
4. Azure Policy

Correct Answer: 3

Explanation

Azure Monitor can collect and analyze performance metrics, logs, and other telemetry from Azure virtual machines. With appropriate monitoring agents and configurations, it can provide operating system-level information useful for troubleshooting and performance analysis. Azure Policy is designed for governance, Advisor provides recommendations, and Azure DNS handles domain name resolution. Therefore, Azure Monitor is the correct service for monitoring VM performance and collecting operational data such as logs and performance information.

Question 158

You need to identify which Azure resources are consuming excessive compute capacity and may be candidates for cost optimization. Which Azure service can provide recommendations?

1. Azure Advisor
2. Azure Files
3. Azure DNS
4. Azure Bastion

Correct Answer: 1

Explanation

Azure Advisor analyzes resource usage and provides recommendations across several categories, including cost optimization. It can identify opportunities such as underutilized virtual machines or resources that may be resized or adjusted to reduce unnecessary spending. Azure DNS provides name resolution, Azure Bastion provides secure VM connectivity, and Azure Files provides shared storage. Therefore, Azure Advisor is the correct service for receiving recommendations related to resource utilization and potential cost savings.

Question 159

You need to manage Azure resources from a command-line environment that supports both Azure CLI and PowerShell through a browser. Which service should you use?

1. Azure Resource Graph
2. Azure Advisor
3. Azure Portal
4. Azure Cloud Shell

Correct Answer: 4

Explanation

Azure Cloud Shell provides a browser-based command-line environment integrated into the Azure portal. It supports both Azure CLI and Azure PowerShell, allowing administrators to manage Azure resources without installing command-line tools locally. Cloud Shell is especially useful when working from different computers because the environment is available through a web browser. Azure Portal provides a graphical interface, Advisor provides recommendations, and Resource Graph is primarily used for querying resource information. Therefore, Azure Cloud Shell is the correct service.

Question 160

You need to query information about resources across multiple Azure subscriptions using a query language without individually opening each resource. Which Azure service should you use?

1. Azure Backup
2. Azure Resource Graph
3. Azure Load Balancer
4. Azure Key Vault

Correct Answer: 2

Explanation

Azure Resource Graph allows administrators to explore and query information about Azure resources across subscriptions using a query language. It is useful for inventory, governance, compliance, and finding resources that match specific properties or configurations. This is more efficient than manually checking individual resources through the Azure portal. Azure Backup protects data, Load Balancer distributes network traffic, and Key Vault manages secrets and keys. Therefore, Azure Resource Graph is the correct service for querying resource information across multiple subscriptions.